CVE-2026-35402 mcp-neo4j-cypher: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures
Attackers can bypass read-only restrictions in the Neo4j MCP server to perform unauthorized write operations or server-side request forgery.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35402?
CVE-2026-35402 is a low-severity server-side request forgery vulnerability in neo4j-contrib mcp-neo4j, published on 17 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode enforcement can be bypassed using APOC CALL procedures, potentially allowing unauthorized write operations or server-side request forgery. This issue is fixed in version 0.6.0.
Weakness: CWE-284
Which versions are affected by CVE-2026-35402?
3 open source packages ship an affected version, including mcp-neo4j-cypher.
| Package | Affected | Fixed in |
|---|---|---|
mcp-neo4j-cypher PyPI | All versions | 0.6.0 |
mcp-neo4j-cypher PyPI | All versions | 0.6.0 |
mcp-neo4j-cypher PyPI | All versions | 0.6.0 |
How do I fix CVE-2026-35402?
Upgrade mcp-neo4j-cypher to 0.6.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-35402 being exploited?
There is no known exploitation of CVE-2026-35402 in the wild and no public exploit code.
Sources
Also known as GHSA-x3cv-r3g3-fpg9, PYSEC-2026-2626.